AlpsCon Whitelist Test-Key Reward Drain

On October 18, 2026, AlpsCon AI Trade Hub, a staking-and-rewards platform on BNB Chain, had its reward pool drained for approximately $152,000 after an attacker combined a staking whitelist that still contained a publicly known test key with a flaw in how the project's new reward contract accounted for past deposits.

What happened

AlpsCon's whitelist for staking and claiming rewards still included the default Hardhat/Anvil test account #0 (0xf39f…2266), whose private key is published in developer documentation and known to anyone. On-chain records show the address was added in a batch registration on August 24, 2025 and left in place for roughly 14 months. Because the key is public, the attacker could act as a whitelisted wallet at will.

The second ingredient was an accounting bug. AlpsCon's new reward contract treated a deposit made moments earlier into the old hub contract as if it had existed from the start, then paid out the corresponding "past" rewards in full. The attacker chained the two flaws together:

1. Used the public test key to sign an EIP-7702 delegation, letting attack code execute as the whitelisted wallet.
2. Took a flash loan of about 1.03 million USDC and bought ALPS tokens.
3. Staked the ALPS into the old hub contract, which still accepted deposits.
4. The new reward contract paid out about 355,000 USDC, emptying the main reward pool.
5. Unstaked, sold the ALPS, repaid the flash loan, and walked away with roughly $152,000.

Aftermath

The entire exploit resolved inside a single transaction (0x824b…5fc2). The deployer removed the test account from the whitelist at 11:40 UTC on October 18, 2026, about five hours after the attack, but by then the reward pool was already empty. As of the first public analyses — flagged on-chain by Defimon and documented in a community write-up — AlpsCon had not published an official statement or announced any recovery of funds. No attacker identity was established; the proceeds stayed in attacker-controlled wallets.

Why it matters

AlpsCon is a reminder that test fixtures left in production are live keys, not placeholders. The Hardhat default account is one of the most widely known private keys in Ethereum development, and its presence on a reward whitelist turned a convenience into an open door. The incident also shows how a benign-looking accounting shortcut — crediting a fresh deposit with historical rewards — becomes catastrophic the moment an attacker can satisfy the access check for free, here via an EIP-7702 delegation funded by a flash loan. It joins a run of October 2026 BNB Chain losses such as 79th Vault, and echoes the reward- and share-accounting bugs seen in smart-contract exploits like UNCX Network: when the math that mints rewards can be gamed, no amount of nominal access control helps if the control itself is misconfigured.